CVE-2026-64551: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-64551 is a kernel memory disclosure vulnerability in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation, specifically in the handling of STALE_COOKIE error causes. When an ERROR chunk with a STALE_COOKIE cause is received in the COOKIE_ECHOED state, the kernel fails to validate the cause length before reading a 4-byte Measure of Staleness field, resulting in an out-of-bounds read of uninitialized kernel memory that is subsequently echoed back to the peer. The vulnerability affects Linux kernel versions from 2.6.12 through multiple stable branches, with fixes backported to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc4. It was published on July 27, 2026, with patches available the same day. The CVSS base score is listed as 0.0 (pending full scoring), with Feedly estimating a Medium severity (GitHub Advisory, Feedly).

The root cause is an improper validation of input length (CWE-125: Out-of-bounds Read) in sctp_sf_do_5_2_6_stale(). The function reads the first cause in the ERROR chunk (err = (struct sctp_errhdr *)(chunk->skb->data)) and then unconditionally reads 4 bytes beyond the cause header as the Measure of Staleness (stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)))), without verifying that the STALE_COOKIE cause is long enough to contain this field. Since sctp_walk_errors() only requires a cause to be at least 4 bytes (the header size), a STALE_COOKIE cause of exactly 4 bytes causes the read to go past the cause boundary, and for a minimal ERROR chunk, past skb->tail into uninitialized memory. The fix validates the STALE_COOKIE cause length in sctp_sf_cookie_echoed_err() before passing it to the handler, and discards causes too short to hold the staleness field (GitHub Advisory, Feedly).

Successful exploitation results in a kernel memory disclosure: uninitialized kernel memory contents are read and echoed back to the attacker in the Cookie Preservative field of a reply INIT packet. This exposes potentially sensitive kernel memory contents — such as stack data, heap contents, or cryptographic material — to a network peer. The vulnerability does not directly enable code execution or privilege escalation, but the leaked memory could be leveraged to defeat KASLR or inform further exploitation (Feedly, GitHub Advisory).

1. Setup: Obtain access to a system with raw SCTP socket capability — this can be achieved by an unprivileged user within a user and network namespace (e.g., using unshare -rn).
2. Initiate SCTP association: Use a raw SCTP socket or a crafted SCTP implementation to initiate an association with the target, driving it into the COOKIE_ECHOED state (i.e., after sending a COOKIE ECHO chunk).
3. Send malformed ERROR chunk: Craft and send an ERROR chunk containing a STALE_COOKIE cause with a length field set to exactly 4 (the minimum header size), omitting the 4-byte Measure of Staleness field.
4. Trigger out-of-bounds read: The vulnerable kernel code in sctp_sf_do_5_2_6_stale() reads 4 bytes past the end of the cause header into uninitialized memory.
5. Receive leaked memory: Observe the reply INIT packet sent by the target kernel; the Cookie Preservative option will contain the leaked uninitialized kernel memory value that was read in step 4.
6. Analyze leaked data: Parse the Cookie Preservative field from the INIT packet to extract the leaked kernel memory contents, which may be used to defeat KASLR or gather sensitive information (Feedly, GitHub Advisory).

• Network: Unexpected SCTP ERROR chunks with STALE_COOKIE cause of length exactly 4 (no Measure of Staleness field) directed at a host in COOKIE_ECHOED state; SCTP INIT packets from the target containing anomalous Cookie Preservative values in response to such ERROR chunks.
• Logs: Kernel logs (dmesg) may show SCTP-related warnings if additional debugging is enabled; unusual SCTP association attempts from unprivileged processes or network namespaces.
• Process: Unprivileged processes creating raw SCTP sockets or using unshare to create user/network namespaces for SCTP communication with external hosts.

Update the Linux kernel to a patched version: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc4 (or later). As a workaround, restrict the ability of unprivileged users to create user and network namespaces (e.g., set kernel.unprivileged_userns_clone=0 on supported distributions) to reduce the attack surface, since exploitation requires the ability to use raw SCTP sockets within such namespaces. Additionally, if SCTP is not required in your environment, consider disabling the SCTP kernel module (modprobe -r sctp or blacklisting it) (GitHub Advisory, Feedly).